Bug 96612

Summary:	crash in module-rtp-recv.c:271
Product:	PulseAudio	Reporter:	Christian Glodt <chris>
Component:	modules	Assignee:	pulseaudio-bugs
Status:	RESOLVED FIXED	QA Contact:	pulseaudio-bugs
Severity:	normal
Priority:	medium	CC:	chris, lennart
Version:	unspecified
Hardware:	x86-64 (AMD64)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:
Bug Depends on:
Bug Blocks:	96750

Description Christian Glodt 2016-06-21 12:24:30 UTC

Loading module-rtp-recv results in a crash. This is on Ubuntu 16.04, PulseAudio package version 1:8.0.0-0ubuntu3.

Please see this thread for context:
https://lists.freedesktop.org/archives/pulseaudio-discuss/2016-June/026377.html

Here's the backtrace:

(gdb) bt full
#0  0x00007ffff6311418 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
        resultvar = 0
        pid = 35355
        selftid = 35359
#1  0x00007ffff631301a in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x2c00000011, sa_sigaction = 0x2c00000011}, sa_mask = {__val = {176093659154, 0, 0, 
              140737111419872, 140737114283993, 6785184, 6798368, 0, 140737324591616, 140737111422464, 140737018593368, 0, 140737018596576, 
              0, 140737200119808, 140737111419728}}, sa_flags = -141746104, sa_restorer = 0x50c}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007ffff78d2051 in pa_memblockq_push (bq=0x73f460, uchunk=0x7fffe9886c20) at pulsecore/memblockq.c:289
        q = 0x3f
        n = 0x7fffe9886b30
        chunk = {memblock = 0x575ae614, index = 540414, length = 3955821}
        old = 0
        __func__ = "pa_memblockq_push"
        __PRETTY_FUNCTION__ = "pa_memblockq_push"
#3  0x00007fffcb9ed235 in rtpoll_work_cb (i=0x7fffe4000b20) at modules/rtp/module-rtp-recv.c:271
        chunk = {memblock = 0x7fffeed1e000, index = 12, length = 1280}
        k = 0
        j = 4294967296
        delta = 0
        now = {tv_sec = 3955821, tv_usec = 947295}
        s = 0x6f7fc0
        p = 0x66f0b8
        __func__ = "rtpoll_work_cb"
        __PRETTY_FUNCTION__ = "rtpoll_work_cb"
#4  0x00007ffff7b5c000 in pa_rtpoll_run (p=0x7c8240) at pulsecore/rtpoll.c:696
        k = 0
        defer_event = 0x0
        time_event = 0x0
        i = 0x7fffe4000b20
        r = 0
        timeout = {tv_sec = 70528, tv_usec = 0}
        next_time_event = 0x0
        next_time_event_elapse = {tv_sec = 3955821946850, tv_usec = 4754025810059539968}
        timer_enabled = false
        __func__ = "pa_rtpoll_run"
        __PRETTY_FUNCTION__ = "pa_rtpoll_run"
#5  0x00007fffe98be040 in thread_func (userdata=0x666bb0) at modules/alsa/alsa-sink.c:1799
        ret = 1
        rtpoll_sleep = 0
        real_sleep = 0
        u = 0x666bb0
        revents = 0
        __func__ = "thread_func"
        __PRETTY_FUNCTION__ = "thread_func"
#6  0x00007ffff78f43fe in internal_thread_func (userdata=0x7c33e0) at pulsecore/thread-posix.c:81
        t = 0x7c33e0
        __func__ = "internal_thread_func"
        __PRETTY_FUNCTION__ = "internal_thread_func"
#7  0x00007ffff6dc16fa in start_thread (arg=0x7fffe9887700) at pthread_create.c:333
        __res = <optimized out>
        pd = 0x7fffe9887700
        now = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140737111422720, -6710472414859945635, 0, 140737488343983, 140737111423424, 0, 
                6710451357242300765, 6710488085811763549}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, 
              cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
        pagesize_m1 = <optimized out>
        sp = <optimized out>
        freesize = <optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#8  0x00007ffff63e2b5d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

Comment 1 Tanu Kaskinen 2016-06-30 16:33:43 UTC

Since this is a crash bug, I'll mark this as a 10.0 blocker (but if this turns out to be hard to debug, I don't promise that we won't remove the blocker status).

Comment 2 Tanu Kaskinen 2016-09-10 14:40:47 UTC

I think this might have been fixed by https://cgit.freedesktop.org/pulseaudio/pulseaudio/commit/?id=c931d41b789b22d4c1f15bb0d14b41011a448c65

The patch is included in PulseAudio 9.0. Do you have a chance to try with a newer pulseaudio version?

Comment 3 Christian Glodt 2016-09-11 14:15:47 UTC

I've tried 9.0 by compiling the package from Ubuntu Yakkety.

Unfortunately I still get the same error:

E: [alsa-sink-USB Audio] memblockq.c: Assertion 'uchunk->index % bq->base == 0' failed at pulsecore/memblockq.c:289, function pa_memblockq_push(). Aborting.

Comment 4 Tanu Kaskinen 2016-09-18 15:10:11 UTC

I'm able to reproduce the crash. I should be able to make a fix soon (probably not today, though).

Comment 5 Tanu Kaskinen 2016-09-20 10:00:18 UTC

Fix submitted: https://patchwork.freedesktop.org/patch/111499/

Comment 6 Christian Glodt 2016-09-21 06:00:24 UTC

With submitted patch it works for me now. Thanks!

Comment 7 Tanu Kaskinen 2016-12-19 23:14:48 UTC

I committed the patch now.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.